fix: resolve forgejo.riotpiao.com to the ingress LB on nodes

The pinned ClusterIP died when the rev-6 upgrade recreated the Service, timing
out every node image pull.

terraform/variables.tf

@@ -179,8 +179,18 @@ variable "cluster_config" {
 
 variable "forgejo_registry_ip" {
   type        = string
-  default     = "10.107.155.96"
-  description = "Forgejo registry (container repo) ClusterIP for host DNS rewrite"
+  default     = "192.168.1.160"
+  description = <<-EOT
+    Address the nodes resolve forgejo.riotpiao.com to, via extraHostEntries.
+    Used by kubelet/containerd for image pulls.
+
+    This is the ingress-nginx LoadBalancer IP, pinned by the Cilium pool
+    192.168.1.160/28, NOT a ClusterIP. It was previously the ingress-nginx
+    ClusterIP 10.107.155.96; the rev-6 Helm upgrade on 2026-08-13 recreated the
+    Service and reassigned that address, leaving every node with a dead hosts
+    entry and every image pull failing on i/o timeout. A ClusterIP rots on any
+    Service recreation; the LB IP does not.
+  EOT
 }
 
 variable "forgejo_hostname" {